On 14 October 2026 the Department for Education (DfE) replaced the Data (Use and Access) Act chapter of its Data protection in schools guidance with a new, practical DUAA compliance checklist for schools. The previous chapter told schools to review their procedures and promised more information "in due course". This is that information: eight themed checklists setting out what changed and what schools are expected to do about it.

---

Below we reproduce each part of the DfE checklist in full. Alongside every action, the For DPE customers column shows where you will find the tool, template or support to meet it. Use it as a working document: tick off what you already have and bring the rest to your DPE consultant.

If you need a refresher on the Act itself, start with What the Data (Use and Access) Act Means for Schools or listen to Podcast Episode 2: Data (Use and Access) Act.

1. Subject access requests (SARs)

What changed: Schools can now pause the one-month response period when they need clarification about an unclear request. Schools only need to carry out reasonable and proportionate searches; exhaustive searches are not required.

DfE checklist: what you need to do	For DPE customers
☐ Review and update your SAR procedure	Use the updated SAR documentation in the SAR best practice area of the Knowledge Bank.
☐ Include a process for pausing timescales when clarification is needed	Record the date you asked for clarification and the date you received it in the Knowledge Bank SAR log, so the revised deadline is clear. Our SAR extension template covers complex requests.
☐ Set clear expectations for carrying out proportionate searches	See Searching for data when you receive a SAR. "Proportionate" does not mean "minimal": record why you searched where you did.
☐ Ensure staff who handle SARs understand the revised requirements	Assign the 2026 data protection e-learning and share SAR, educational record or FOI? with front-office staff.
☐ Create or update your decisions log to include details about the scope of searches and any clarification requested	Log every SAR in the Knowledge Bank SAR log. If you are an 'All You Can Eat' redaction customer, log a ticket and we will log the SAR on  your behalf. Add search scope and clarification notes to the existing entry as the request progresses.

Further reading: SARs and coerced consent · DPE Redaction Tool

2. Data protection complaints

What changed: Schools must have a clear process for handling data protection complaints. Individuals must normally raise their complaint with the school before contacting the ICO. Complaints must be acknowledged within 30 days and dealt with without undue delay.

DfE checklist: what you need to do	For DPE customers
☐ Create or review your data protection complaints procedure	Our updated policy documentation in the Knowledge Bank explains how data protection complaints sit alongside your existing complaints procedure. Remember many school complaints policies only cover parents of current pupils; a data protection complaint can come from anyone whose data you hold.
☐ Make it easy for individuals to submit a complaint in a range of different formats	Accept complaints by email, letter, phone and in person, and make sure your website explains how. Your DPE consultant can review the wording.
☐ Ensure staff know how to recognise and escalate a complaint	Share Complaints vs. Data Rights: A Guide with staff who deal with parents and the public.
☐ Clearly explain to individuals how complaints are managed and escalated	Covered in the DPE model privacy notices and policy templates. Your DPE consultant can advise on escalation to the ICO, and manage on your behalf.
☐ Keep complainants informed about progress and outcomes	Record each update in the Knowledge Bank Complaints Log so you can show when and how you responded.
☐ Update privacy notices to explain how people can make a complaint	DPE will provide further privacy notice updates.
☐ Maintain a log of complaints and outcomes	Use the Complaints Log in the Knowledge Bank.

Further reading: The ICO is changing behind the scenes · ICO guidance on data protection complaints

3. Automated decision-making and AI

What changed: The DUAA allows wider use of automated decision-making, provided appropriate safeguards are in place. Individuals must be informed when automated decisions are made about them, and must be able to challenge decisions, make representations and request a human review.

DfE checklist: what you need to do	For DPE customers
☐ Identify any systems that use automated decision-making	Check attendance alerts, behaviour points that trigger sanctions, AI marking tools and adaptive learning platforms. AI can also be switched on inside systems you already use: see Arbor AI: On by Default.
☐ Ensure a person can review decisions and change the outcome where appropriate	Record the human review step in the system's DPIA. Use our AI DPIA and ask your consultant for support.
☐ Update policies and guidance so that staff involved in reviews understand the requirements expected of them	Adopt the updated DPE AI Policy Template.
☐ Explain the use of automated decision-making in privacy notices	Add any systems you identify to your DPE model privacy notices.
☐ Tell individuals when automated decision-making is used, how decisions are made and how they may affect them	Explain this in privacy notices and at the point the system is introduced. Use age-appropriate wording for pupils.
☐ Provide a simple process for individuals to challenge a decision, give additional information and request a human review	This can follow your data protection complaints route. Log challenges in the Knowledge Bank Complaints Log.
☐ Make information about this process easy to find	Link to it from your privacy notice page on the school website.

Further reading: New DfE AI Standards · AI in Schools: Six Pillars for Getting it Right

4. Recognised legitimate interests

What changed: The DUAA introduces a new lawful basis called recognised legitimate interests. It applies only to specific activities set out in law, including safeguarding vulnerable people, preventing crime, responding to emergencies, national security, and sharing information for certain public purposes where permitted by law. Schools cannot create their own. Public authorities cannot rely on it to carry out their statutory functions, so public task will usually remain the most appropriate lawful basis.

DfE checklist: what you need to do	For DPE customers
☐ Consider whether any processing activity falls within one of the recognised legitimate interests set out in legislation	For most school processing, nothing changes. If you think an activity might fit, raise it with your DPE consultant before changing your documentation.
☐ Continue to use public task or legal requirement for processing carried out as part of the school's official function	The lawful bases in DPE templates already reflect this. No action needed unless you have changed them locally.
☐ Continue to complete legitimate interests assessments where standard legitimate interests are used	Ask your DPE consultant or the DPO helpdesk for support with legitimate interests assessments.
☐ Update policies, guidance and staff training where needed to explain the use of the different lawful bases	Covered in the 2026 data protection e-learning and DPE policy templates.
☐ Review and update privacy notices to ensure the lawful bases used for the different processing activities are correct	Check against the May 2026 DPE model privacy notices.
☐ Update Records of Processing Activities (RoPA), data sharing agreements and related documentation if lawful bases change	Update your Record of Processing in the Knowledge Bank. See How the Record of Processing can help you.

Further reading: The DUAA: what does it mean for schools and MATs?

5. Children's data and safeguarding

What changed: The DUAA reinforces existing UK GDPR requirements that children need extra protection, and confirms that data protection law supports appropriate information sharing to safeguard children. Decisions about sharing safeguarding information should be necessary, proportionate and properly recorded.

DfE checklist: what you need to do	For DPE customers
☐ Review safeguarding information sharing procedures	See Sharing information to safeguard children. Data protection should never be the reason a safeguarding concern isn't shared.
☐ Provide clear guidance on when and how information can be shared safely and who needs to be consulted	See KCSIE 2026 Data Protection Changes and assign the KCSIE 2026 course.
☐ Keep records of safeguarding decisions and information sharing	Record the reason for every decision, whether or not you share. Log a ticket with DPE if you are unsure.
☐ Make privacy information suitable for children and young people	Use the free DPE child-friendly privacy notices.
☐ Use clear and age-appropriate language when explaining data protection matters to account for a variety of age, maturity and vulnerabilities in pupils	As above. Use the child-friendly notices alongside your full notices, and ask your consultant if you need wording for pupils with additional needs.
☐ Update internal guidance to reflect that children's privacy is considered by default when introducing new systems and technologies	Build it into procurement using the DfE Procurement Risk Guide and the lessons from the ICO EdTech Audit.
☐ Carry out DPIAs where required, particularly for higher-risk processing involving AI tools, EdTech and monitoring technologies	Use DPE DPIA templates and the AI DPIA. For monitoring, see The DSL's Guide to Filtering and Monitoring.

Further reading: Data Protection & DPIAs: Safeguarding Pupil & Staff Data

6. Privacy notices and transparency

What changed: Privacy notice requirements remain largely unchanged, but schools may need to update them to reflect new DUAA requirements, including complaint processes, automated decision-making and lawful bases for processing.

DfE checklist: what you need to do	For DPE customers
☐ Review all privacy notices to make sure they are accurate and up to date, easy to find, written in plain English and age-appropriate where relevant	The May 2026 DPE model privacy notices were updated for the DUAA and the Children's Wellbeing and Schools Act. Replace any older versions on your website.
☐ Update privacy notices to include lawful bases for processing, including recognised legitimate interests where used	Included in the May 2026 notices. Speak to your consultant before adding recognised legitimate interests.
☐ Update privacy notices to include details of any automated decision-making	Add the systems you identified in section 3. These will be specific to your school.
☐ Update privacy notices to include information about scientific research activities where relevant	Most schools will not need this. If you take part in research projects, email This email address is being protected from spambots. You need JavaScript enabled to view it..
☐ If carrying out scientific research: document and record the reasons for any decision to rely on the "impossible or disproportionate effort" exemption, and ensure privacy information remains publicly available	Your DPE consultant can help you document this decision.
☐ Set a regular review schedule for all privacy notices	Keep an eye on Knowledge Bank Updates for new versions of the DPE model notices. Add an annual check of your website to your compliance calendar.

7. Cookies and online tracking (if applicable)

What changed: PECR has been amended so that some low-risk cookies may no longer require consent. This includes certain cookies used for website statistics and service improvements, user preferences such as language or accessibility settings, and emergency location services.

DfE checklist: what you need to do	For DPE customers
☐ Review cookies and tracking technologies used on school websites	Most school websites are run by a third-party provider. Ask yours for a list of the cookies the site sets.
☐ Identify which cookies may fall within the new exemptions	Send the list to the DPE helpdesk if you are unsure. Embedded videos and social media feeds usually still need consent.
☐ Update cookie policies where necessary	Ask your website provider to update the policy and keep their confirmation on file.
☐ Review cookie banners and consent mechanisms	As above: this is usually a setting your provider controls.
☐ Keep records of decisions to rely on any exemptions	Store the provider's confirmation with your website records.
☐ Check that third-party website services remain compliant with PECR requirements	Include PECR questions in your supplier due diligence.

Further reading: Guardians of Privacy: Social Media and Cookies

8. Digital verification services (if applicable)

What changed: The DUAA introduces a framework for certified digital identity verification services. Schools may choose to use certified providers, but there is no requirement to do so.

DfE checklist: if using a DVS	For DPE customers
☐ Confirm the provider appears on the official register	Watch for identity checks in recruitment and visitor management systems. See Visitor Management: A Guide for Schools.
☐ Assess data protection risks before implementation	Tell your DPE consultant before you sign up.
☐ Carry out a DPIA where required, as this is a new and innovative technology	Use DPE DPIA templates, with consultant support.
☐ Identify and document the lawful basis for processing	Record it in the DPIA and your Record of Processing.
☐ Update privacy notices to explain how the service is used	Add it to the relevant DPE model notice (for example, staff or visitor).
☐ Review contracts and data sharing arrangements with the provider	Follow the DfE Procurement Risk Guide and our supplier due diligence process.

What to do next

1. Work through the checklist with your data protection lead and tick off what you already have in place. Most of this will already be covered in your Annual Compliance Review with your consultant.
2. Prioritise complaints and SARs. These carry legal deadlines and are where gaps are most visible to parents and the ICO.
3. Check your website is showing the current DPE privacy notices.
4. Brief governors and trustees. The checklist gives them a clear framework for asking how the school has responded to the DUAA, and it fits naturally alongside your annual compliance review against the ICO Accountability Framework. Our guide to the role of governors can help.
5. Talk to us. If you are unsure where your school stands, a DPO Compliance Check-In through our Governance Gateway or a Making the Rounds data walk will give you a clear picture. Not yet a DPE customer? Find out about our Data Protection Officer service.

This checklist builds on the DfE's earlier updates, which we covered in DfE updates Data Protection in Schools guidance: what schools need to know.

Sources: DfE: Data (Use and Access) Act 2025 (DUAA): compliance checklist for schools (updated 14 October 2026). DfE checklist content is reproduced under the Open Government Licence v3.0. ICO: How do we prepare to handle data protection complaints?